MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 631726707000002f909fe14db4eb064eb9bb60a4359b318fb9c29feb79462727. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 631726707000002f909fe14db4eb064eb9bb60a4359b318fb9c29feb79462727
SHA3-384 hash: 66eb5c32db856212d8214d78f7902cb36b38d5d151f954bd8b9948383a5a906e3c64641b4374ed20f7e64a67f65c0654
SHA1 hash: 4cc062cfb7639b7bb493eeccc41eb38f76428046
MD5 hash: a689ab5137e40fdabf1ff043c64c6332
humanhash: louisiana-purple-summer-december
File name:INVOICE_No78M.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'715 bytes
First seen:2021-03-11 06:22:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:7SlF+Pqms5+BVQths1b4+2RyIc9mpxcGOTH82RSpWq:7aFosk7QPWb4xRvcg+vRSZ
TLSH B6A4231BC26CACDB3CCE94B97BD56920CAEC96EB182B4272FC0C51D9936764236550CF
Reporter cocaman
Tags:AgentTesla INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Manjit <sales@u-mkt.live>" (likely spoofed)
Received: "from u-mkt.live (u-mkt.live [117.50.98.82]) "
Date: "11 Mar 2021 05:01:53 +0700"
Subject: "Proforma Invoice."
Attachment: "INVOICE_No78M.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/631726707000002f909fe14db4eb064eb9bb60a4359b318fb9c29feb79462727/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 06:23:04 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
12 of 47 (25.53%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmlsm4dqaaac7ee74fg3j2ygj243wyfegwntdd5zykp6w6kge4tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/631726707000002f909fe14db4eb064eb9bb60a4359b318fb9c29feb79462727

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 631726707000002f909fe14db4eb064eb9bb60a4359b318fb9c29feb79462727

(this sample)

AgentTesla

Executable exe 80696b82979f9ef0936df9b0406561d491778061ce19469508097dd6b21d9bd7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80696b82979f9ef0936df9b0406561d491778061ce19469508097dd6b21d9bd7
  
Dropping
AgentTesla

Comments